Don't send touch events to windows like menus when the touch occurs outside the menu bounds.

ui/events/gesture_detection/touch_disposition_gesture_filter.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/events/gesture_detection/touch_disposition_gesture_filter.h"
 
 #include <stddef.h>
 
 #include "base/auto_reset.h"
 #include "base/logging.h"
@@ skipping 150 matching lines @@
     return INVALID_PACKET_ORDER;
 
   if (packet.gesture_source() == GestureEventDataPacket::TOUCH_TIMEOUT &&
       Tail().empty()) {
     // Handle the timeout packet immediately if the packet preceding the timeout
     // has already been dispatched.
     FilterAndSendPacket(packet);
     return SUCCESS;
   }
 
-  // Check the packet's unique_touch_event_id is valid and unique.
+  // Check the packet's unique_touch_event_id is valid and unique with the
+  // exception of TOUCH_TIMEOUT packets which have the unique_touch_event_id_
+  // of 0.

[tdresser, 2016/01/14 15:35:40]

Add to this comment something along the lines of:
|TOUCH_TIMEOUT| packets don't wait for an ack, they are dispatched as soon as
they reach the head of the queue, in |SendAckedEvents|.

[ananta, 2016/01/14 20:09:30]

Done.

   if (!Tail().empty()) {
-    DCHECK_NE(packet.unique_touch_event_id(),
-              Tail().back().unique_touch_event_id());
+    DCHECK((packet.gesture_source() == GestureEventDataPacket::TOUCH_TIMEOUT)
+            || (packet.unique_touch_event_id() !=
+                    Tail().back().unique_touch_event_id()));
   }
   if (!Head().empty()) {
-    DCHECK_NE(packet.unique_touch_event_id(),
-              Head().front().unique_touch_event_id());
+    DCHECK((packet.gesture_source() == GestureEventDataPacket::TOUCH_TIMEOUT)
+            || (packet.unique_touch_event_id() !=
+                    Head().front().unique_touch_event_id()));

[tdresser, 2016/01/14 15:35:40]

I don't think we should ever reach this code with a TOUCH_TIMEOUT packet at the
front of the queue. We should have already dispatched the TOUCH_TIMEOUT packet
in the most recent SendAckedEvents.

Did you ever see this trip in practice?

[ananta, 2016/01/14 20:09:30]

No. I just changed the DCHECK for consistency. The first one does fire though.
Hence that change is needed.

[tdresser, 2016/01/14 20:14:10]

Yeah, it makes sense that the first would fire. Let's remove the second DCHECK,
and maybe add a comment indicating that TOUCH_TIMEOUT packets should never read
the head of the queue.

[ananta, 2016/01/14 20:21:14]

Done.

   }
 
   Tail().push(packet);
   return SUCCESS;
 }
 
 void TouchDispositionGestureFilter::OnTouchEventAck(uint32_t unique_event_id,
                                                     bool event_consumed) {
   // Spurious asynchronous acks should not trigger a crash.
   if (IsEmpty() || (Head().empty() && sequences_.size() == 1))
@@ skipping 278 matching lines @@
   return false;
 }
 
 bool TouchDispositionGestureFilter::GestureHandlingState::
     HasFilteredGestureType(EventType gesture_type) const {
   return any_gesture_of_type_dropped_.has_bit(
       GetGestureTypeIndex(gesture_type));
 }
 
 }  // namespace content